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Abstract 

A computerized method for collecting suspected data of interest from a 
computer comprises searching the computer's shot-term memory to locate at 
least one target memory range containing the suspected data of interest, and 
copying the suspected data of interest within the target memory range to an 
alternate data storage location in a manner which avoids writing the 
suspected data to the computer's long-term memory. Alternatively, the 
suspected data of interest can be copied to a previously unused data storage 
location while preserving integrity of non-volatile memory resources. A 
computer-readable medium and a system for collecting target forensics data 
are also provided. 


